Abstract: A method for analyzing network incidents within a network and providing prioritized remediation recommendations is disclosed. The method includes: receiving network data and computing a plurality of network incidents from the network data, collecting network incidents related to a particular network issue over a time period and grouping the network incidents according to root-cause symptoms, generating a network incident graph by superimposing groups of network incidents over a network graph, analyzing the network incident graph to identify localized areas with systemic issues; and based on the analysis of the network incident graph, generating and displaying a list of remediation recommendations. Each remediation recommendation includes a systemic issue in the network, a remediation to resolve the issue, and a quantified expected benefit from implementing the remediation.

Abstract: A system and method for providing automatic closed loop control of a network using a dynamic control loop. The system includes one or more collectors and a remote network manager. The one or more collectors are configured to receive network traffic data from a plurality of network elements in the network. The remote network manager computes an initial control policy to the programmable network elements using (1) high-level policies, security requirements, and any anomalous traffic behavior; (2) configuration capability and current configuration of underlying network elements; (3) network topology, statistics, and tolerable configuration change; and (4) control loop parameters including stability, oscillation, and timescale.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes one or more collectors and a remote network manager. The one or more collectors are configured to receive network traffic data from a plurality of network elements in the network. The remote network manager is configured to connect to the one or more collectors over the Internet via a network interface. The one or more collectors extract metadata from the network traffic data and send the metadata to the network manager.

Abstract: A system and method is disclosed of extracting information from real-time network data to analyze roaming data for client devices in a network. The method includes: detecting when the client devices initiate roaming association events, buffering other data regarding the detected roaming association events, sending roaming event information to an analytics system for network incident and network congestion analysis, analyzing the roaming event information, identifying one or more root causes of the detected network incidents; and determining remediation of the identified one or more root causes of the detected network incidents.

Abstract: A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

Abstract: A system and method for client network congestion analysis and management is disclosed. According to one embodiment, the method includes: collecting real-time network data; executing calculations on the real-time network data to compute performance metrics; detecting peak usage time; and detecting one or more congestion incidents, wherein a congestion incident comprises a persistence of one or more metrics over a time window that comprises detecting a proportion of metric values crossing a threshold that exceeds a defined percentage amount, detecting a time-ordered stretch of metric values that exceeds a defined threshold, or combinations thereof.

Abstract: A system and method for automatic detection of a network incident from real-time network data is disclosed. The method includes: collecting real-time network data; executing performance calculations on the real-time network data to compute performance metrics; and detecting a pattern over a time window, wherein detecting a pattern includes detecting a proportion of metric values crossing a threshold exceeding a defined percentage amount, detecting a presence of a sequence of metric values, detecting a time-ordered stretch of metric values with a length of the time-ordered stretch exceeding a defined threshold, detecting a cyclical presence of a sequence of metric values, or combinations thereof.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes a plurality of network elements, a programmable network element, and one or more collectors. The one or more collectors are configured to collects filtered network traffic data from the plurality of network elements based on a time-varying schedule.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes one or more collectors and a programmable network element. The one or more collectors are configured to receive network traffic data from a plurality of network elements in the network and extract metadata from the network traffic data. The programmable network element is programmed based on the metadata received from the plurality of network elements in the network.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes a plurality of network systems, and a remote network manager. The remote network manager is configured to connect over the Internet to the plurality of enterprise systems, a plurality of collectors, or combinations thereof. The remote network manager simultaneously and centrally analyzes a network condition of a plurality of network systems, learns a network pattern from a first network system of the plurality of network systems, and predicts a network behavior of a second network system of the plurality of network systems.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes one or more collectors, a network manager, and a programmable network element. The one or more collectors are configured to receive network traffic data from a plurality of network elements and extract metadata from the network traffic data. The network manager is configured to receive metadata from the one or more collectors. The network manager identifies a network control objective for the network, identifies a programmable parameter of the programmable network element to achieve the network control objective, and programs the programmable network element. The network manager further determines whether the network control objective is met after programming the programmable network element and applies a control loop based on the network control objective to program the programmable network element.

Abstract: A system and method for observing and controlling a programmable network via higher layer attributes is disclosed. According to one embodiment, the system includes one or more collectors and a remote network manager. The one or more collectors are configured to receive network traffic data from a plurality of network elements in the network. The remote network manager is configured to connect to the one or more collectors over the Internet via a network interface. The one or more collectors extract metadata from the network traffic data and send the metadata to the network manager.